--- a/sys/dev/misc/syscons/scvgarndr.c
+++ b/sys/dev/misc/syscons/scvgarndr.c
@@ -786,6 +786,10 @@ draw_pxlcursor_direct(scr_stat *scp, int at, int on, int flip)
 	unsigned char *char_data;
 	vm_offset_t draw_pos;
 
+	if (scp->cursor_base < 0 || scp->cursor_base >= scp->font_height)
+		return;
+
 	line_width = scp->sc->adp->va_line_width;
 	pixel_size = scp->sc->adp->va_info.vi_pixel_size;
 
@@ -838,6 +842,10 @@ draw_pxlcursor_packed(scr_stat *scp, int at, int on, int flip)
 	unsigned char *char_data;
 	vm_offset_t draw_pos;
 
+	if (scp->cursor_base < 0 || scp->cursor_base >= scp->font_height)
+		return;
+
 	line_width = scp->sc->adp->va_line_width;
 
 	draw_pos = VIDEO_MEMORY_POS(scp, at, 8) +
@@ -886,6 +894,10 @@ draw_pxlcursor_planar(scr_stat *scp, int at, int on, int flip)
 	int i;
 	u_char c;
 
+	if (scp->cursor_base < 0 || scp->cursor_base >= scp->font_height)
+		return;
+
 	line_width = scp->sc->adp->va_line_width;
 
 	d = VIDEO_MEMORY_POS(scp, at, 1) +